Recent speculation suggested that Microsoft intended to integrate a mouse pointer locator feature directly into Windows 11. This feature draws heavy inspiration from the utility previously offered…

The relentless deluge of newly discovered vulnerabilities has intensified to such an extreme degree that Canonical found its historical Ubuntu kernel update rhythm fundamentally inadequate. Conseq…

CVE WATCHTOWER logged 2,825 new vulnerabilities between September 21 and September 27, 2026. Of those, 218 scored CVSS 9.0 or higher. This weekly CVE report focuses on the flaws attackers already …

At a Glance Attribute Details Actor or Group TraderTraitor (aka UNC4899, Jade Sleet, PUKCHONG) Activity Type Fake job recruitment, supply chain compromise, credential theft Targets or Victims IT s…

TL;DR This month, Apple issued critical security patches to address a local privilege escalation flaw in macOS. The macOS CoreServices vulnerability allows a malicious application to gain root pri…

TL;DR Two Citrix NetScaler zero-day flaws allowing remote code execution have been exploited in the wild. The alert began with a leaked NCSC-NL pre-notification and was echoed by watchTowr and Kev…

God damn it, we're back in the room again.

Yes, that sound in your ears is screaming. The footgun has gone off again, shockingly, and we are yet again dealing with a situation where the entire world apparently knew about Citrix NetScaler CVEs before Citrix…

Most XSS reports stop at medium because the researcher tried to steal a session instead of using one. The primitive that changes that fits…

H7 CTF — ctf.h7tex.com

Hello everyone! My name is Aditya Nail Emery. This is my second vulnerability writeup.

Large Language Models have moved far beyond simple chatbots. Modern AI applications can retrieve private documents, execute code, call…

A practical guide to setting up OpenCode, Claude-BugHunter, and Burp Suite MCP Server for automated HTTP history analysis and security…

A story about a LinkedIn DM that aged surprisingly well, why I started caring about bug bounty when I swore I never would, and the exact…

How I Read an Application Before Trying to Hack It Back when I first started doing bug bounties, I was mostly concerned about functionality in the beginning. What I would usually do is analyze a …

This bug didn’t involve a single request to the target’s actual application. The entire vulnerability lived in a DNS record someone forgot…

How to handle 50,000+ rows, fuzzy header mapping, and data validation without freezing the UI thread or crashing your app.

That is what “first-class features” means to us. Not security as culture, which turns into no one’s job. Not security as a team, which…

A vulnerability in PHP's URL validation functionality has highlighted an important application security lesson: input validation errors can…

Picture a small Lagos startup. Two founders, one app, a few thousand users, and a pitch deck that says “bank-grade security” somewhere…